oidc: allow setting redirect server port#1768
Merged
Merged
Conversation
Add a redirect_port parameter to Issuer.identity_token so callers can bind the local OAuth redirect server to a fixed port. Useful for OIDC providers that require a pre-registered redirect URI without localhost port wildcards. Closes sigstore#1029 Signed-off-by: Antonio Mazzini <antoniomazzini55@gmail.com>
Member
|
/gcbrun |
jku
approved these changes
May 13, 2026
Member
jku
left a comment
jku
left a comment
There was a problem hiding this comment.
Seems reasonable to me.
The default values in _OAuthRedirectServer and _OAuthFlow look unnecessary since we always provide a value but that seems like a nitpick.
Member
|
Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an optional
redirect_portargument toIssuer.identity_tokenso callers can bind the local OAuth redirect server to a fixed port
instead of always using an ephemeral one.
Some enterprise OIDC providers (and Microsoft Entra ID under certain
configurations) require a pre-registered redirect URI and do not allow
wildcards on
localhostports, which currently blockssigstore-pythonfrom being used in those environments.
cosignalready exposes a--oidc-redirect-urlflag that solves the same problem on the CLI side.The default of
0preserves the existing behaviour (OS-assigned port).Closes #1029
Test plan
make lint— ruff/mypy/bandit/interrogate greenpytest test/unit— 177 passed, no regressionstest_identity_token_passes_redirect_portverifiesthe parameter is forwarded to the OAuth flow